1

Well, one of my clients made an iTunes backup of her old iPhone right before she wipe and sell it. She never expected that the backup is corrupted till she got a new iPhone and tried to restore that backup and iTunes threw an error. Anyway, her main concern about the notes. I tried to explore the backup with some third party programs but none of them could get me the Notes. We also contacted with Apple to see if they can help with fixing the backup or with anything in general but unfortunately they couldn't offer us much help. I could extract Notes app documents and database but when I try to explore it in DB SQLite Browser, it says "Encrypted database" and it needs the password in order to decrypt it. My client does know nothing about it so, what are my options here? Brute-force? or what exactly as I don't have any experience when it comes to SQL databases.

enter image description here

enter image description here

Improve this question
7
  • 1
    Was the back up encrypted? Is the password for that the password used to access the phone?
    – user7886229
    Commented Apr 4, 2018 at 2:59
  • @Josh The weird part is that the backup isn’t encrypted at all, just the notes and call logs, no more. For example; I can easily using iBackupBot explore contacts but when I switch to notes tab, I get an error that either database is encrypted or corrupted but when I try to load the extracted database, SQL browser asks for encryption. Anyway, iTunes backup encryption can’t be specified for a certain data inside the backup (as far as I know) a backup can’t be partially encrypted. What I think it might be a logical scenario is that the notes has been encrypted with some third party app (idk).
    – Mohamed Shibo
    Commented Apr 4, 2018 at 3:07
  • 1
    This may help: support.apple.com/en-us/HT205794 Although that only applies to specific notes
    – user7886229
    Commented Apr 4, 2018 at 3:09
  • @Josh Uhh! That explains much. I really never knew about this feature although I’m an iPhone user 😅. Now we know why Notes are encrypted and how. Weird that client said she never locked it before. Just one more question; if she doesn’t know, is there anyway to break into it? Like brute-force using hashcat or something?
    – Mohamed Shibo
    Commented Apr 4, 2018 at 3:16
  • Haha I see the inner hacker coming out. Unfortunately (for you but fortunate for everyone else), Apple is pretty good with security. I would take a guess that you will not be able to crack it. I have 3 possible solutions check answers.
    – user7886229
    Commented Apr 4, 2018 at 3:29

1 Answer 1

Reset to default
2

Notes Recovery

The Easy Method

  1. Check on iCloud.com - Sign in and Navigate to the Notes App
  2. Check on other emails used - iPhone saves none local (and non iCloud) Notes as emails on the users email server. Navigate to the email login for the email they use and check for a Notes folder. In Gmail its on the left sides bar.

Notes: If The Easy Method works then the client can set up the phone from scratch and sign in with there email. The notes should sync.

The Technical Method

  1. Restore the iPhone and login with the same Apple ID, create a single note. Backup this phone (non-encrypted). Navigate to the Notes folder on the new backup and replace the contents in the new backup with the contents of the notes from the old backup. Restore the phone using the new backup. If it says its corrupted then the Notes are probably indeed corrupted.

The Hacking Method

  1. I suggest heading over to https://security.stackexchange.com for cracking hashes and other things.

Next Time

  1. Make a backup in iTunes normally. Archive it. Make another backup

  2. Make sure all notes are on iCloud or a Email Server

  3. Use a Mac --> This ones just a preference :)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .